Here comes the scary part

It is a dark night in Tel Aviv, the kind in which bad things lurk in dark corners. Sitting in a small cafe with the security expert, I hear the wind blowing between the trees. The waitress looks worried as well. A dark night indeed. I look across the table to my partner, a serious person with thick eye glasses that add to his already grim demeanor. Then, to accent his last sentence, he leans towards me - his glasses almost opaque in the dim light - and barely whispers: "but you know, man, you know what the real problem is, right? the real problem is BOTS!".

Oh, is it really?

I didn't go to the MRC conference this year. Somehow, boogieman stories from interested third parties (over early morning session, in Vegas!) sounded less appealing for someone who needed to fly 18 hours for the experience. I did, however, read excerpts and ideas. Boy, I have to admit that the set up was a lot more successful than a Tel-Aviv cafe. Because here's the thing with 3rd party vendors - they are looking to sell, and if you're looking for the real gap in your system (rather than the perceived one), you probably shouldn't be looking at that direction. Let's see what's hot this year: it sppears that Malware and Botnets are attacking everyone, and that Machine ID and phone verification might be the only way of stopping this.

Now's probably the right moment to wonder what's my case. True. Here's my case: buying flashy new technologies when you haven't exploited the old ones is pricy, redundant, plain dumb sometimes. Most of the merchants that will purchase anti-malware and machine id solutions do not, I bet, have a decent user-location system in place, and are instead declining multiple good buyers who live in a set of black-listed locations; most of the merchants that will purchase phone verification products will double their fraud operation costs before they realize that calling alarge percentage of the transaction volume only slows them down instead of bringing that solution to loss mitigation. My case is - proper analysis of what you're dealing with, rather than going with the nifty, trendy new fraud filter, will bring you much higher ROI and a method for solving your own problem. It does, however, require some extra effort that cannot be bought off the shelf: training the right kind of people to do the right kind of work. More on that in future posts.

Black men can't shop?

Here's a familiar scenario:

Your working late hours, late enough to reach the time when you have to go and get yourself a strong one from the coffee house downstairs to wake everyone up. Only after you volunteer to be the ones who'll go get it you find that you forgot your card at home. No problem, what could be simpler? You just borrow your friend's card.
After choosing exactly what you need, with a list you made earlier at the office, come the time to pay. You reach into your wallet and hand the cashier your firend's card. It's ok, your friend gave you the card. Even when the slip needs to be signed you sign it, it doesn't matter what signature you use (btw, do you sign your own or "invent" one for the friend?), no one will notice anyway, right?

Wait.

You've just committed the basic scenario in "card present" C2B (consumer-to-business) frauds, ones in which there's a real plastic that's being put through the POS (point-of-sale) terminal.
True, you're no thief (or "carder", as one may be called). You did this all very honestly and there's no suspicion of a crime. The cashier came out clean - indeed he didn't use a very simple identity verification method (forinstance - asking for a driver's license, like other "stung" merchants already do) yet the liability is on the issuer, as long as the buyer signs the slip.

You are not thieves maybe but Gregory K, for instance, is. His method was a combination of the very simple and the somewhat sophisticated: He scanned trash cans and looked for copies of credit card slips. Sometimes he did great and hacked computers over eMule and other file sharing platforms to copy credit details. He used those details to buy online - in this kind of shopping it's much easier to pretend you're someone else, you can be Barbara from Australia for all we know, all you need is her card details and some other details people usually keep together with their card, when they are gullable and unsuspecting. Gregory had it easy, he lives in the states, and it will cost him a few years behind bars now, carried away by the (justified) fear of identity theft.

So why can't black men shop? Well, the legitimate ones can, but the thieves among them, those who orchestrate scams from third world countries, find that going into a store with a just-stolen card and claiming to be George Costanza the third will be a bit hard, but stealing on the net is so much easier and profitable. In addition, when shopping over the net the purchases are under the merchants' resposibility and those - lacking substantial knowledge in preventing fraud - turn into easy victim to sophisticated Nigerian, Vietnamese and Russian carder exploiting many stations en route to the desired loot of watches, jewelry and electronics for thousands of dollars.

How do the merchants protect themselves? Well, they just don't sell, or ask for riculously frustrating actions (you can't imagine how many times a year does an Israeli need to send their passport's or credit report's scan, little to mention not even being able to ship to Israel). Next time, when you get rejected over a simple order online, remember Greg K. and his Nigerian friends, that cost the eCommerce business billions of dollars a year, and turn online shopping into a much more complicated procedure.